Total
730 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-45231 | 1 Djangoproject | 1 Django | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). | |||||
| CVE-2024-45089 | 1 Ibm | 1 Sterling B2b Integrator | 2026-06-17 | N/A | 4.3 MEDIUM |
| IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensitive filename information due to an observable discrepancy. | |||||
| CVE-2024-45052 | 1 Ethyca | 1 Fides | 2026-06-17 | N/A | 5.3 MEDIUM |
| Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system. This vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server's response time to authentication requests. This information can be used to conduct further attacks on authentication such as password brute-forcing and credential stuffing. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no workarounds. | |||||
| CVE-2024-43546 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 21h2 and 5 more | 2026-06-17 | N/A | 5.6 MEDIUM |
| Windows Cryptographic Information Disclosure Vulnerability | |||||
| CVE-2024-43095 | 1 Google | 1 Android | 2026-06-17 | N/A | 7.8 HIGH |
| In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | |||||
| CVE-2024-42343 | 1 Loway | 1 Queuemetrics | 2026-06-17 | N/A | 5.3 MEDIUM |
| Loway - CWE-204: Observable Response Discrepancy | |||||
| CVE-2024-42174 | 1 Hcltech | 1 Dryice Myxalytics | 2026-06-17 | N/A | 3.7 LOW |
| HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames. | |||||
| CVE-2024-41952 | 1 Zitadel | 1 Zitadel | 2026-06-17 | N/A | 5.3 MEDIUM |
| Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". Due to a implementation change to prevent deadlocks calling the database, the flag would not be correctly respected in all cases and an attacker would gain information if an account exist within ZITADEL, since the error message shows "object not found" instead of the generic error message. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8, and 2.53.9. | |||||
| CVE-2024-41880 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. | |||||
| CVE-2024-41760 | 2 Ibm, Linux | 4 Aix, Common Cryptographic Architecture, I and 1 more | 2026-06-17 | N/A | 3.7 LOW |
| IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA operations. | |||||
| CVE-2024-41741 | 1 Ibm | 1 Txseries For Multiplatforms | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system. | |||||
| CVE-2024-41715 | 1 Gotenna | 1 Atak Plugin | 2026-06-17 | N/A | 4.3 MEDIUM |
| The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used. | |||||
| CVE-2024-40490 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function. | |||||
| CVE-2024-39921 | 1 Fujitsu | 38 Ipcom Ex2 Dc 3200, Ipcom Ex2 Dc 3200 Firmware, Ipcom Ex2 Dc 3500 and 35 more | 2026-06-17 | N/A | 7.5 HIGH |
| Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IPCOM VE2 Series V01L04NF0001 to V01L06NF0112. If this vulnerability is exploited, some of the encrypted communication may be decrypted by an attacker who can obtain the contents of the communication. | |||||
| CVE-2024-39891 | 1 Twilio | 2 Authy, Authy Authenticator | 2026-06-17 | N/A | 5.3 MEDIUM |
| In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.) | |||||
| CVE-2024-39830 | 1 Mattermost | 1 Mattermost | 2026-06-17 | N/A | 8.1 HIGH |
| Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison. | |||||
| CVE-2024-38465 | 1 Guoxinled | 1 Synthesis Image System | 2026-06-17 | N/A | 5.3 MEDIUM |
| Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error. | |||||
| CVE-2024-38431 | 1 Matrix-globalservices | 1 Tafnit | 2026-06-17 | N/A | 5.3 MEDIUM |
| Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy | |||||
| CVE-2024-38322 | 1 Ibm | 1 Storage Defender Resiliency Service | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869. | |||||
| CVE-2024-37880 | 1 Pq-crystals | 1 Kyber | 2026-06-17 | N/A | 7.5 HIGH |
| The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel that allows attackers to recover an ML-KEM 512 secret key in minutes. This occurs because poly_frommsg in poly.c does not prevent Clang from emitting a vulnerable secret-dependent branch. | |||||